insecure password option

[hadmut]

Hi,
the command line tools like amqp-publish and amqp-consume are insecure, since the username/password can be given as a command line parameter either with --password= or as part of the URL given with --url.

Passwords given as command line parameters are insecure, since they can be seen in the process list.

It should have alternative options to have the password read from a given file or pipe.

[ckastner]

Hi,

I can confirm this issue, it is easily reproduced:

$ pgrep -a ampq-consume
62287 amqp-consume --url amqp://user:pass@192.168.0.1 --queue=myqueue

So using --password or --url exposes the login details to anyone on the host who can see the process list.